Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
07/05/2024, 14:14
General
-
Target
ThriveEditV2unpacked.exe
-
Size
5.9MB
-
MD5
12f6acf0fdb2afe0dbc788ff98d4bf93
-
SHA1
ace41cd34e15f41b53687bba0e475f5feab9da66
-
SHA256
ac6c454cc4b65dfc6ad603f8dec0542bd0cdb03d9ab6e47759c21ab3c2588253
-
SHA512
8e6df87361d5b8d9cc15d7e2725c04db63aca16713557b8d7658c671f5ff2fafb6f39fcab97b9d18ea52cf78e9d5451bc125875d001ea17dfca6359b387c58a7
-
SSDEEP
98304:A52s231bwGAeRrqqg46O02B8kjuz6anB0JmgNhVRwS+KH4kpc+DX/0HN:S2s231AMrqqgrQBxanGcgRRwVKYOD
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Control Panel 13 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ThriveEditV2unpacked.exe"C:\Users\Admin\AppData\Local\Temp\ThriveEditV2unpacked.exe"1⤵
- Enumerates system info in registry
- Modifies Control Panel
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
4.0MB
-
Filesize
9.9MB
-
Filesize
2.0MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB